<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; "><div>Are there any other creative blocking strategies?</div><div><br></div><div>I'll implement the User-Agent idea immediately. Duh. Hadn't even occurred to me.</div><div><br></div><div>- Darren</div><div><br></div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> anorexicpoodle <<a href="mailto:anorexicpoodle@gmail.com">anorexicpoodle@gmail.com</a>><br><span style="font-weight:bold">Date: </span> Thu, 25 Nov 2010 22:38:34 -0800<br><span style="font-weight:bold">To: </span> Lee Riemer <<a href="mailto:lriemer@bestline.net">lriemer@bestline.net</a>><br><span style="font-weight:bold">Cc: </span> "<a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a>" <<a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a>><br><span style="font-weight:bold">Subject: </span> Re: [VoiceOps] Strange register attack<br></div><div><br></div><div>
<div>
This is a well-known attack. If you're running an Acme, contact TAC, they have a HMR ruleset that will blackhole this attack based on the user agent, though if your access side is tuned up well enough it should black-hole itself pretty quickly. <br><br>
On Thu, 2010-11-25 at 23:44 -0600, Lee Riemer wrote:
<blockquote type="CITE"><pre>Yes, this is normal. Just figure out how to deal with it.
On 11/25/2010 11:03 PM, Darren Schreiber wrote:
> We've been suffering from this, too. The SIP headers are hacked and
> completely bogus. They seem to be from only a few select IPs from us.
>
> I'm about ready to abandon port 5060 :-)
>
> - Darren
>
>
> On 11/25/10 9:03 PM, "Peter Childs"<<a href="mailto:PChilds@internode.com.au">PChilds@internode.com.au</a>> wrote:
>
>> sql> select count(ua) from sip_trace where ua = 'friendly-scanner';
>> COUNT(UA): 22330
>>
>> We get thousands of these scans from all over the joint all the time.
>>
>> That is in the last 8 hours...
>>
>> sql> select count(fromip), fromip from sip_trace where ua =
>> 'friendly-scanner' group by fromip;
>> COUNT(FROMIP): 3
>> FROMIP : 124.195.52.250
>>
>> COUNT(FROMIP): 1
>> FROMIP : 124.254.44.172
>>
>> COUNT(FROMIP): 13127
>> FROMIP : 202.101.187.66
>>
>> COUNT(FROMIP): 9199
>> FROMIP : 74.218.78.29
>> (4 rows, 10201 ms)
>>
>>
>> I occasionally have discussions with others about
>> <a href="http://tools.ietf.org/html/rfc5635">http://tools.ietf.org/html/rfc5635</a> using some thresholds to block some of
>> these at the border, with the problem being that one day someone will use
>> some cloud platform and we will take out we shouldn't.
>>
>> The ACME SBCs we use seem to eat this stuff up ok, but some of the issues
>> we encounter
>> 1. Customers with SIP CPE where a high volume of SIP trash causes the
>> CPE to lock
>> 2. Customers running Asterisk implementations getting cracked and
>> owned
>>
>> Cheers,
>> Peter
>>
>> On 26/11/2010, at 1:32 PM, Colin wrote:
>>
>>> Tonight i'm seeing hundreds of register attempts per second to one of
>>> my SBC's from an IP in china 61.142.250.96.
>>>
>>> the From: and to: line is always one of these 2 below.
>>>
>>> \"118\"<<a href="sip:118@my">sip:118@my</a> SBC IP>; source port 5063
>>> \"qwerty\"<<a href="sip:qwerty@my">sip:qwerty@my</a> SBC IP>; source port 5067
>>>
>>>
>>>
>>> user-agent: friendly-scanner is always.
>>>
>>> Looks like sipvicious default user agent. Anyone seen a register flood
>>> like this before?
>>>
>>>
>>>
>>> Colin
>>>
>>>
>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> VoiceOps mailing list
>>> <a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a>
>>> <a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a>
>>
>> _______________________________________________
>> VoiceOps mailing list
>> <a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a>
>> <a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a>
>
> _______________________________________________
> VoiceOps mailing list
> <a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a>
> <a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a>
_______________________________________________
VoiceOps mailing list
<a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a><a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a></pre></blockquote><br></div></div></span></body></html>